Attachment_3_TO_2_PWS_-_Cybersecurity_Support_Services.docx

DTRA Agency-Wide Information Technology Support Services Core IT Services Contract –

HDTRA1-18-R-0002

Performance Work Statement (PWS) for Task Order 2; Cybersecurity Support Services

1. Introduction: This PWS provides agency-wide cybersecurity support services to ensure DTRA and its partners have secure and efficient IT capabilities and services necessary to perform the critical DTRA mission, and compliant with DoD mandates and INFOCON requirements.

1.1. Mission: The DTRA mission is to safeguard the United States and its allies from global weapons of mass destruction and improvised threats by integrating, synchronizing and providing expertise, technologies and capabilities. The DTRA Information Integration and Technology Services Directorate (I2TS)/Chief Information Officer’s (CIO) mission is to provide the IT services and capabilities necessary for DTRA’s business and mission functions and support transforming how the agency uses knowledge, technologies, and capabilities to meet the DTRA mission.

1.2. Background: The I2TS is responsible for providing Agency-wide information management services, supporting in excess of 5,000 world-wide Agency customers utilizing Unclassified, Secret, and Top Secret/Special Compartmented Information (TS/SCI) Networks (for a more detailed description of the current networks see Attachment 1). DTRA personnel supporting the Agency’s mission require common IT services in areas such as, but not limited to, help desk support, systems administration, networks and application administration and design, engineering, and architecture development and implementation. Although the functional requirements are similar across the DTRA mission, the activities involved vary widely by specific mission area. Various short and long-term efforts must be undertaken to continually modernize, integrate and secure functions and systems. Continuous IT support must meet the needs of the Agency and other internally (including JIDO) and externally supported customers to include first responders, Combatant Commands (COCOMS) and other U.S. Government entities. The intent is to provide seamless and integrated communications among all supported elements, for the purposes of office automation, data collaboration and knowledge management, support of exercises, experimentation and operational support across three principle security domains: Sensitive but Unclassified (SBU), Secret and Top Secret/SCI. The DTRA mission supports a diverse set of customers and unique mission requirements. As the organization evolves, the demands on information technology (IT) and associated cybersecurity controls increase accordingly.

1.3. Scope: In support of the DTRA mission and CIO priorities, the contractor shall provide the full range of cybersecurity support services (to include risk management framework), computer network defense (CND)), and communications security (COMSEC). Additionally, this support includes implementation, operations, and management of cross-domain solutions. The goal is to provide an integrated delivery of cybersecurity services and solutions to support IT requirements across the agency. The contractor shall strive to improve the confidentiality, availability, and integrity of DTRA IT systems, modernize the security infrastructure to maintain and improve compliance with DoD mandates and INFOCON requirements.

2. Applicable Documents: The contractor shall comply with all documents listed below as “Mandatory”. Documents listed as “Non-Mandatory” are provided as information only and for use at the contractor’s discretion.

2.1. Mandatory Documents: (updated versions may be applicable)

2.1.1. DoDI 8500.01, Cybersecurity

2.1.2. DoDI 8510.10, Risk Management Framework (RMF), Change 1, May 24, 2016

2.1.3. NIST Special Publication 800-53, Version 4, Security and Privacy Controls for Federal Information Systems and Organizations

2.1.4. CJCSI 6510.01F, Information Assurance (IA) and Support to Computer Network Defense (CND), 9 Feb 2011

2.1.5. CNSSI No.1253, Security Categorization and Control Selection for National Security Systems

2.1.6. CJCSM 6510.01B, “Cyber Incident Handling Program,” July 10, 2012

2.1.7. DoDD 8140.01, Cybersecurity Workforce Management

2.1.8. DOD 8570.01M, Information Assurance Workforce Improvement Program

2.1.9. DTRA/SCC-WMD Directive 8570.01, Information Assurance Training, Certification, and Workforce Management

2.2. Non-Mandatory Documents:

2.2.1. DTRA Strategic Plan

2.2.2. DTRA J6, CIO Information Operations Strategic Plan 2017 - 2020

2.2.3. DTRA Cloud Strategy

3. Performance Requirements: This section of the PWS defines the performance requirements and results against which the government intends to measure the contractor’s performance. These performance requirements address the full scope of this task order and support the higher-level goal stated in paragraph 1.3 above. They provide the full range of support actions and resources necessary to improve the confidentiality, availability, and integrity of DTRA IT systems, modernize the security infrastructure, and to maintain and improve compliance with DoD mandates.

3.1. Performance Requirement #1, Task Order Management. The contractor shall provide the necessary resources to effectively oversee the performance of all requirements defined in this task order. Within this responsibility, the contractor shall develop and implement a quality control and management oversight plan to effectively manage the staff and the performance per the standards established herein. The contractor shall plan for surge support requirements associated with unforeseen incident resolution, inspections, audits, and exercises. The contractor shall develop and deliver a monthly status report (MSR) per CDRL A001. Performance measures for this requirement are defined in the Performance Requirements Summary (PRS) in Section 5 below and include timeliness of staff on-boarding, timeliness of deliverables, and consistency in meeting other performance measures within this task order.

3.2. Performance Requirement #2, Cybersecurity Policy and Planning. The DTRA Senior Information Security Officer (SISO) serves as the focal point and principal advisor for all DTRA information technology matters on behalf of the CIO to ensure compliance with overarching cybersecurity regulations. The SISO also serves as the Authorizing Official for DTRA systems. In support of the SISO, the contractor shall coordinate DTRA's cybersecurity tasks, controls, and activities in accordance with Agency and DoD policies. This task includes such activities as cybersecurity policy review, interpretation, and applicability, cybersecurity policy development, strategic planning, and policy rollout, compliance tracking, enforcement, and reporting. (CDRL A008) This task also includes additional tasks to include: Authorizing Official Designated Representative (AODR) support, risk assessment, risk management, POA&M management and tracking. Performance measures for this requirement are defined in the PRS below and focus on support resulting in consistent “green” DoD Cybersecurity Scorecard ratings for DTRA IT security, based on standards defined in the DoD Cybersecurity Discipline Implementation Plan (dated Oct 2015; amended Feb 2016).

3.3. Performance Requirement #3, Assessment and Authorization Support Services. In direct support of the DTRA I2TS Authorizing Official, the contractor shall assess all DTRA networks, communication conduits, systems, devices, and applications to ensure DTRA personnel, data and operations remain secure thereby enabling the accomplishment of DTRA's mission to detect and deter the use of weapons of mass destruction. Performance measures for this requirement are defined in the PRS below and focus on timely issuance of notices, alerts, directives, assessments and authorizations consistent with DoDI 8510.10.

3.4. Performance Requirement #4, Continuous Monitoring. In support of the DTRA I2TS IOC Cybersecurity department, the contractor shall evaluate, track, and report the security posture status of DTRA systems to achieve compliance with Agency and DoD cybersecurity initiatives and system requirements including: Command Cyber Readiness Inspection (CCRI) scores, Authority to Operate (ATO), Annual Security Review (ASR), vulnerability and configuration management, and other related DoD cybersecurity initiatives, inspections, assessments and audits. This task includes the continued transition and implementation of DoDI 8510.01 Risk Management Framework (RMF). Technical analysis and recommendations shall be documented and delivered per CDRL A003. Performance measures for this requirement are defined in applicable DoD Instructions/Regulations.

3.5. Performance Requirement #5, Cross-Domain Solutions. The contractor shall provide the full range of resources and services necessary to support the secure transfer of data between different security domains and provide multi-network access solutions that allow analysts to view multiple networks of different security levels from a secure workstation. The DTRA Cross Domain Support Element (CDSE) interprets mission requirements and works with the enterprise cross domain solution providers to fulfill these needs. Technical analysis and recommendations shall be documented and delivered per CDRL A003. Performance measures for this requirement are defined in the PRS below and focus on the ability to consistently generate reports and recommendations that are approved by the Defense Security Authorization Working Group without revisions.

3.6. Performance Requirement #6, Supply Chain Risk Management. In support of the DTRA I2TS IOC Cybersecurity department, the contractor shall review and incorporate protective measures during the acquisition planning process, and implement agency security practices throughout the lifecycle of IT systems, to minimize and mitigate risk and vulnerabilities in government information and communications technology (ICT) systems.

3.7. Performance Requirement #7, Cybersecurity Service Provider (CSSP) Support Services. In support of the DTRA I2TS IOC Cybersecurity department, the contractor shall provide the required resources and expertise to support 24x7x365 cybersecurity monitoring and response across DTRA’s distributed network operations environment. Working with the DTRA I2TS IOC, contractor CSSP analysts and engineers shall collaborate with various teams throughout the agency to process intelligence, determine threat, develop mitigations, monitor for attacks, and assess risk while providing cyber based Situational Awareness to agency leadership and stakeholders. The contractor shall monitor computer network defense services in a manner that effectively safeguards the confidentiality, integrity, and availability of DTRA-supported network environments and Information Technology infrastructure. The contractor shall provide the required resources and expertise to ensure compliance with DoD CSSP Evaluators Securing Metrics (ESM). The contractor shall provide support within the existing CSSP structure which includes four simultaneously running processes tooled to assist and defend the system subscriber. These processes include a Protect Team, a Detect Team, a Response Team, and a Sustain Team.

3.7.1. The Protect team serves as the Subscriber Cybersecurity Liaison and provides dedicated cybersecurity support. Specific CSSP Protect services include:

· Vulnerability Analysis and Assessments (VAA) (Regular Assured Compliance Assessment Solution (ACAS) or other tool reporting verification and high level guidance)

· Coordinates external Blue/Red Team assessments

· Conducts Blue Team, vulnerability, and compliance assessments.

· Vulnerability Management (VM) (Liaise and coordinate, Regular validation and high level guidance)

· Virus/Malware Protection (Regular validation and high-level guidance)

· Information Operations Condition (INFOCON)/Cyber Protection Condition (CPCON) (Regular validation and high-level guidance)

· Service Level Agreement (SLA) monitoring and support

· Customer Outreach and product development

· Plan for and conduct annual internal CSSP ESM compliance assessments. The first annual audit shall be completed no later than, 90 days after contract award.

3.7.2. The CSSP Detect Team continuously monitors the DTRA enterprise network for unauthorized activity. Performs all source cyber threat research and analysis. Performs tending and analysts of the security posturer of the agency and its subscribers. Performs proactive “hunting” for cybersecurity vulnerabilities and areas of concern.

3.7.3. The CSSP Response Team supports incident response, analysis, and reporting as appropriate to the Tier I US CyberCom and DTRA Leadership. (CDRL A008)

3.7.4. The Sustain Team maintains the integrity and security of the CSSP SecureNet enclaves and associated security tools, to include ArcSight (ESM and Logger), Splunk, Bro, Symantec, Cisco Firepower, security enclave, network taps, Sidewinder firewalls, etc., and ensures compliance with the new Risk Management Framework (RMF) requirements.

3.7.5. Performance measures for this requirement are defined in the PRS below and focuses on consistent compliance to cybersecurity standards for on time reporting (consistent with CJCSM 6510.01B) and passing all DoD CSSP Evaluators Securing Metrics (ESM) reviews. The next re-certification will occur 3rd Quarter FY19.

3.8. Performance Requirement #8, Promoting Cybersecurity throughout the Agency Workforce. Working with and in support of the DTRA I2TS IOC Cybersecurity department, the contractor shall develop and implement strategies and programs to ensure employees in cybersecurity roles, Computer Network Defense (CND) roles, and any positions requiring privileged access remain in compliance with DoD Directive 8140.01, "Cyberspace Workforce Management". This task includes maintaining, revising and making available requisite cybersecurity training in alignment with end user position requirements and designated workforce levels. The contractor shall also ensure appropriate measures are available to efficiently track DTRA end-user compliance with required cybersecurity training. (CDRL A005) Performance measures for this requirement are defined in applicable DoD Instructions/Regulations.

3.9. Performance Requirement #9, Communication Security (COMSEC). The contractor shall provide the full range of administration, audit support, Communications Security (COMSEC) management, and telecommunications support for the Agency network domains and architectures from the Unclassified level up through Top Secret SCI, to include 24x7 (on-call) support as defined by the Agency. Performance measures for this requirement are defined in applicable DoD Instructions/Regulations.

3.10. Performance Requirement #10, Procurement. The contractor shall procure security response items and/or mission critical items that are in-service and fail/failing or are deemed by the I2TS/Agency to be immediate response requirements. Network monitoring equipment/sensors, security response items are used to ensure continuous and uninterrupted CND operations. Fail or Failing items are defined as mission critical components that have failed or are in a non-repairable status that poses imminent risk of near-term failure and poses a critical risk to Agency mission. Immediate response requirements are items that may be required to immediately secure Agency supported (may be a customer/subscriber) systems against a previously unknown threat. Any procurement under this CLIN will be authorized by the Contracting Officer and approved by the COR.

3.11. Performance Requirement #11, Task Order Transition In. The contractor shall plan for and execute a transition-in strategy to provide for the on-boarding of appropriately qualified personnel, with the required DoD security clearances and eligibilities, needed to support a smooth and seamless transition from the incumbent support team to “full performance” within 60 calendar days of task order award. Transition-in includes all staffing activities, as well as the necessary knowledge transfer and capture to ensure “work-in-progress” is smoothly transitioned, and mission support is not interrupted. Transition-in shall include validation of DoD Cybersecurity Workforce Certification requirements IAW DoD Directive 8140.01, Cybersecurity Workforce Management. Performance measures for the first 60 days will be recorded and reported for monitoring purposes, but they will not be used as performance indicators until the completion of the 3rd month of performance. The exception to this suspension of performance measures will be measures associated with this transition-in requirement. The performance measure for this requirement is defined in the PRS below and focuses on the on-boarding of support staff per the transition-in plan included in the contractor proposal.

3.12. Performance Requirement #12, Task Order Transition Out. The contractor shall plan for and support the smooth and seamless transition-out at the end of the performance period. The contractor shall develop and deliver a transition-out plan (CDRL A004) defining their knowledge transfer plan with specific emphasis on transiting work-in-progress. The contractor shall coordinate with the incoming workforce (government or contactor) as necessary to enable a seamless transition with minimum interruption of mission support. The contractor shall remain accountable for performance consistent with the PRS below until the end of the contract period of performance.

4. Deliverables: In support of the requirements in this PWS, the contractor shall develop and deliver a variety of reports, analyses, recommendations, and plans. The specific requirement for content, format, and delivery timing for each deliverable is defined in the Contract Data Requirements Lists (CDRL; DD Form 1423) which will be specifically associated with the PWS paragraph for the corresponding work scope. Unless specifically stated otherwise in the CDRL, all deliverables shall be submitted electronically in either a MS Office compatible or PDF format. The specific format for each deliverable shall be at the contractor’s discretion unless otherwise specified in the CDRL. The following table summarizes the contract deliverables associated with this PWS.

4.1. Deliverables Summary Table

Monthly delivery; NLT 5th working day of the month

5. Period of Performance. The period of performance will be a one-year base, with up to four one-year options, if exercised.

5.1. Base: Task order award + 12 Months

5.2. Option 1: To be specified at award

5.3. Option 2: To be specified at award

5.4. Option 3: To be specified at award

5.5. Option 4: To be specified at award

6. Support Hours The contractor shall provide support during the core Government hours 52 weeks a year. The standard schedule must encompass the DTRA core hours of 9 AM to 3 PM (0900 – 1500). Additionally, the contractor may be required to provide support outside of standard hours based on loss of service and mission impact or Agency need. The CSSP support services (paragraph 3.7) are 24x7x365 requirements. Standard work hours shall be Monday through Friday during normal duty hours except for the following Federal Holidays:

7. Place of Performance/Travel

7.1. Place of Performance: Currently the majority of these tasks are performed at the Defense Threat Reduction Center, 8725 John J. Kingman Road, Fort Belvoir, VA 22060-6201, however; DTRA maintains a global mission and contractor personnel may be required to work at locations other than the NCR. DTRA relies on distributed operations between the NCR and DTRA Albuquerque, NM. As DTRA becomes more virtualized, and physical space within the DTRA facilities become a premium commodity, support and operations from locations other than DTRA may be necessary to reduce the physical contractor onsite footprint. For situational reasons, contractor personnel may work at an alternate location/worksite using Government Furnished Equipment (GFE) with COR approval.

7.2. Travel may be required based on Agency requirements to any DTRA facility world-wide. The Contractor shall provide a detailed estimate of any desired travel in advance to the COR via memorandum or email. Travel costs shall not exceed on a daily basis the maximum per diem rates in effect at the time of travel as set forth in the Federal Travel Regulation. All travel shall be approved by the COR in writing via memorandum or e-mail prior to the contractor incurring any travel expenses and prior to any departure.

8. Security: (Reference DD Form 254, DoD Contract Security Classification Specifications) The contractor employees working on this program must be U. S. citizens, and they will require a minimum of a DoD SECRET clearance in order to provide the required support. Selected individuals may require Top Secret or higher clearances (SCI Access). Rationale: All employees performing services on this contract have the potential to access classified systems up to TS-SCI (JWICS) as a normal requirement in the performance of their duties.

The contractor shall comply with the Security Agreement (DD Form 441) including the National Industrial Security Program Operating Manual (NISPOM) and any revision, notice of which has been furnished to the contractor. The contractor's employees performing work under this contract shall be U.S. citizens and be granted appropriate security clearances based on the need for access to specific classified information. That is SECRET clearance based on favorably adjudicated National Agency Check with Law and Credit Check (NACLC) or a TOP SECRET clearance based on Single Scope Background Investigations favorably adjudicated by the Defense Security Service, Defense Industrial Security Clearance Office.

All contractors in privileged user positions must have a completed single scope background investigation (SSB I) in accordance with DODI 8500.2 prior to filling the position. Privileged users are defined as, but not limited to, persons in the following roles or positions: Information Assurance Managers/Officers, supervisors of IT positions, systems administrators, and maintainers of IA-enabled products.

In support of this task order it is anticipated that up to 75% of staff will require TS/SCI clearance within 6 months of contract award.

9. Government Furnished Property, Equipment or Material (GFP/GFE/GFM) The Government will provide office space, desks, computers, use of telephone, copiers, faxes, paper, and other administrative materials on-site for personnel assigned to this task order.

9.1. Government Furnished Property for Contractor Use

DTRA may provide Government equipment to the contractor for use offsite. The contractor shall comply with the contract clauses for accountability of Government Property in the possession of contractors.

The contractor shall update the Master Government Property List (MGPL) when any new equipment is issued to the contractor by the government. (The MGPL shall include all equipment/property provided to the contractor, including equipment transferred between projects, broken and obsolete equipment, and items purchased outside the United States. The MGPL shall be delivered electronically in a spreadsheet using Microsoft Office Excel. Abbreviations are not allowed. Ninety (90) days prior to contract expiration, the Contractor shall submit a final MGPL suitable for close-out purposes containing use/disposition recommendations. (CDRL A006)

9.2. Contractor Purchased Government Material

If the contractor is required to purchase any Government Furnished Material, all purchases of hardware and software shall be in accordance with the procedures of Federal Acquisition Regulations (FAR) Part 45 and Defense Federal Acquisition Regulations (DFAR) and shall be approved to purchase, by the Contracting Officer’s Representative (COR), and shall be considered Government Property. As such, all care, maintenance, and consideration apply, and the same as it would for GFE hardware or software (CDRL A006). The contractor shall be liable for Government Property in their possession pursuant to FAR 52.245-1, as applicable.

10. Section 508 Contract Data Requirements List (CDRL) deliverables, in Section 4 above, should meet applicable accessibility requirements and should not adversely affect accessibility features of existing EIT technologies. Information, documentation, and support requirements from 36 CFR part 1194 Subpart D have been determined to apply to this acquisition. Solicitation respondents must describe how the information, documentation, and support proposed for Contract Services deliverables will meet at least those information, documentation, and support requirements identified as applicable in the attached Government Product/Service Accessibility Template (GPAT).

Task Order 2; PWS for Cybersecurity Support Services

11. Performance Requirements Summary (PRS)

Average Staff Availability Metric (Non-Key Personnel) = (Total hours accumulated within period for Non-Key Personnel) / (# of key personnel positions X available workhours in period) Metric begins after transition period AQL for Key Personnel > 95%

AQL for Non-Key Personnel > 90% Data will be collected from MRS and will be as of the cut-off date of the MSR for each period.

NOTE: on-time deliverable assumes the item is accepted as compliant by the government reviewer. A rejected deliverable will be withdrawn from the delivered count and the metric will be recalculated.

Metric = (# of “Green” ratings earned) / total number of rating events.

The performance standard is 100% greens

Percent of On-Time Issuances = (number of notices, alerts, directives, assessments, and authorizations completed within established timeline) / (Total number of notices, alerts, directives, assessments, and authorizations requiring action) Performance Standard for Percent of On-Time A&A Issuances = 100%

Percent of Key Cybersecurity Key Performance Metrics = (number of cybersecurity key performance metrics per system analyzed/reported within established timeline) / (Total number of key performance metrics per system requiring analysis/reporting) Performance Standard for Percent of Reported Key Cybersecurity Performance Indicators = 100%

Metric = (# of reports & recommendations submitted and approved by DSAG without resubmissions) / (Total number of reports and recommendations submitted within the period) Standard = 100%

Training Compliances = (Number of agency personnel current on all required cybersecurity training) / (Number of agency personnel required to have cybersecurity training) The performance standard for Training Compliance = 100%

Staff Transition Metric = # of planned staff positions fully on-boarded at DTRA / # of staff positions scheduled to be on-boarded at end of performance period.

1st Month AQL > 85% 2nd Month AQL > 95% 3rd Month AQL > 98%

The contractor shall collect data to support this metric from their QA program and include the calculated metric in the MSR